X-Recon – A Utility For Detecting Webpage Inputs And Conducting XSS Scans

1adec3df60266e9dd34766d99375879e94e4a2426576e7fa68edf5c1e2ffe396

A utility for identifying web page inputs and conducting XSS scanning.


Features:

  • Subdomain Discovery:
  • Retrieves relevant subdomains for the target website and consolidates them into a whitelist. These subdomains can be utilized during the scraping process.

  • Site-wide Link Discovery:

  • Collects all links throughout the website based on the provided whitelist and the specified max_depth.

  • Form and Input Extraction:

  • Identifies all forms and inputs found within the extracted links, generating a JSON output. This JSON output serves as a foundation for leveraging the XSS scanning capability of the tool.

  • XSS Scanning:

  • Once the start recon option returns a custom JSON containing the extracted entries, the X-Recon tool can initiate the XSS vulnerability testing process and furnish you with the desired results!


1895cf6c9833f3c2264b2d04f90c75732637cc36d5d11be998256bc19c8b4e5d

Note:

The scanning functionality is currently inactive on SPA (Single Page Application) web applications, and we have only tested it on websites developed with PHP, yielding remarkable results. In the future, we plan to incorporate these features into the tool.



488a7384845e2b43cc25b97829beeed81992daccfcd187ccce283e3ca0b807c3

Note:

This tool maintains an up-to-date list of file extensions that it skips during the exploration process. The default list includes common file types such as images, stylesheets, and scripts (".css",".js",".mp4",".zip","png",".svg",".jpeg",".webp",".jpg",".gif"). You can customize this list to better suit your needs by editing the setting.json file..

Installation

$ git clone https://github.com/joshkar/X-Recon
$ cd X-Recon
$ python3 -m pip install -r requirements.txt
$ python3 xr.py

Target For Test:

You can use this address in the Get URL section

  http://testphp.vulnweb.com


A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

To keep up to date follow us on the below channels.